{% set local_ip = inventory_hostname %}
KUBE_APISERVER_OPTS="--enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \
--v=2 \
--etcd-servers={% for host in groups['etcd'] %}https://{{ hostvars[host].inventory_hostname }}:2379{% if not loop.last %},{% endif %}{% endfor %} \
--bind-address={{ local_ip }} \
--secure-port=6443 \
--advertise-address={{ local_ip }} \
--allow-privileged=true \
--service-cluster-ip-range={{ service_cidr }} \
--enable-admission-plugins=NodeRestriction \
--authorization-mode=RBAC,Node \
--enable-bootstrap-token-auth=true \
--token-auth-file={{ k8s_link_dir }}/cfg/token.csv \
--service-node-port-range={{ service_nodeport_range }} \
--kubelet-client-certificate={{ k8s_link_dir }}/ssl/server.pem \
--kubelet-client-key={{ k8s_link_dir }}/ssl/server-key.pem \
--tls-cert-file={{ k8s_link_dir }}/ssl/server.pem  \
--tls-private-key-file={{ k8s_link_dir }}/ssl/server-key.pem \
--client-ca-file={{ k8s_link_dir }}/ssl/ca.pem \
--service-account-key-file={{ k8s_link_dir }}/ssl/ca-key.pem \
--etcd-cafile={{ k8s_link_dir }}/ssl/etcd/ca.pem \
--etcd-certfile={{ k8s_link_dir }}/ssl/etcd/server.pem \
--etcd-keyfile={{ k8s_link_dir }}/ssl/etcd/server-key.pem \
--service-account-issuer=api \
--service-account-signing-key-file={{ k8s_link_dir }}/ssl/ca-key.pem \
--requestheader-client-ca-file={{ k8s_link_dir }}/ssl/ca.pem \
--proxy-client-cert-file={{ k8s_link_dir }}/ssl/server.pem \
--proxy-client-key-file={{ k8s_link_dir }}/ssl/server-key.pem \
--requestheader-allowed-names=kubernetes \
--requestheader-extra-headers-prefix=X-Remote-Extra- \
--requestheader-group-headers=X-Remote-Group \
--requestheader-username-headers=X-Remote-User \
--enable-aggregator-routing=true \
--audit-log-maxage=30 \
--audit-log-maxbackup=3 \
--audit-log-maxsize=100 \
--audit-log-path={{ k8s_link_dir }}/logs/k8s-audit.log"
